vps-new-manager @0.1.4
Vulnerability report · Last retrieved from osv.dev July 8, 2026 at 7:23 PM UTC
OSV ID
MAL-2026-7014
Ecosystem
npm
Summary
The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time.
Source: amazon-inspector (b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.